Artemis: Defending Against Backdoor Attacks via Distribution Shift

Backdoor attacks can exploit vulnerabilities in the training process of Deep Neural Networks (DNNs), introducing hidden malicious functionality that can be activated by a specific input pattern. Existing defenses typically rely on the assumption of a significant difference between poisoned and clean samples. However, subtle differences in dynamic and low poisoning ratio attacks can conceal poisoning features, thereby evading defenses. In this work, we propose a novel backdoor defense approach called Artemis, which utilizes distribution shifts to eliminate the discrepancy between poisoned and benign samples in the feature space. Additionally, Artemis learns from domain-invariant features after the shift. To further enhance the purification of backdoors in DNNs, we incorporate soft knowledge distillation into Artemis to guide the alignment of features between the source dataset domain and the generated distribution-shift dataset domain. We extensively compare our proposed method with 5 state-of-the-art (SOTA) defensive techniques under 9 SOTA attacks on 4 datasets to demonstrate its effectiveness and robustness. Our results show that our method, Artemis, can successfully purify dynamic and low poisoning ratio backdoor attacks and outperform existing defenses by a significant margin. We release the code at https://github.com/xmyun/Artemis.